The short version: your briefs, references, candidates and approved pieces are yours. We never train on them, and we never sell them.
Heimdall is a control room for one-person content studios, operated by Heimdall Studio Ltd. This notice explains what we collect, why, and how long we keep it. It applies to the app, this website and our support channels.
We keep the smallest set of data that makes the product work. Three categories, and nothing beyond them:
Studio content is processed to run the product: expanding a brief into a spec, sending a unit to the provider you chose, storing candidates for review, and recording what an approval was made against.
Operational data is used to keep the service up, bill credits correctly and investigate faults. We use aggregate, non-identifying counts to understand which features earn their place.
Your briefs, references, candidates and approved pieces are never used to train our models or anyone else’s, and are never sold, licensed or shared for advertising.
Providers we route generations to are contractually bound to process inputs only to return the result. Where a provider offers a no-training mode, we use it by default and note it in the Trust centre.
Running a piece means sending the prompt, references and parameters you approved to the provider selected in the recipe — for example Google, Runway, OpenAI or ElevenLabs. We send what the generation needs and nothing else.
The current subprocessor list, with the region each one processes in, is published in the Trust centre and updated before any addition takes effect.
Studio content stays until you delete it or close the studio. Deleting a piece removes its candidates and receipts within 30 days, including from backups on their normal rotation.
Ledger entries are kept for seven years because they are financial records. Operational logs are kept for 90 days.
Wherever you are, you can ask for a copy of your data, correct it, delete it, or object to a particular processing activity. In the UK and EU these are statutory rights under UK GDPR and GDPR; in California, under the CCPA as amended.
You can export your studio yourself at any time from Settings — briefs, recipes, approvals and the ledger, as JSON plus the original media.
We are based in the UK and use providers in the UK, EU and United States. Transfers out of the UK and EEA rely on the UK Addendum and the EU Standard Contractual Clauses, with a transfer risk assessment on file for each provider.
Material changes are announced in-app and by email at least 14 days before they take effect, with the previous version kept available for comparison.
Export, correction and deletion requests go to [email protected] and are answered within 30 days. Our data protection contact is the same address.